20 attempts against mh-ssh on sonic

58.87.69.15 (CN/China/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Oct  9 12:43:35 server4 sshd[10716]: Failed password for root from 217.19.154.220 port 34731 ssh2
Oct  9 12:43:49 server4 sshd[10760]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.131.140  user=root
Oct  9 12:43:51 server4 sshd[10760]: Failed password for root from 104.131.131.140 port 35258 ssh2
Oct  9 12:40:23 server4 sshd[8981]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.87.69.15  user=root
Oct  9 12:40:24 server4 sshd[8981]: Failed password for root from 58.87.69.15 port 45388 ssh2
Oct  9 12:49:11 server4 sshd[13858]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.208.60  user=root

IP Addresses Blocked:

217.19.154.220 (IT/Italy/-)
104.131.131.140 (US/United States/-)

Mail/25/465/587-993/995 Probe, Reject, BadAuth, Hack, SPAM -

Oct  8 22:25:02 minden010 sshd[24738]: Failed password for r.r from 86.106.136.68 port 2857 ssh2
Oct  8 22:25:04 minden010 sshd[24738]: Failed password for r.r from 86.106.136.68 port 2857 ssh2
Oct  8 22:25:06 minden010 sshd[24738]: Failed password for r.r from 86.106.136.68 port 2857 ssh2
Oct  8 22:25:08 minden010 sshd[24738]: Failed password for r.r from 86.106.136.68 port 2857 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=86.106.136.68

Automatic report - Port Scan

Unauthorized connection attempt detected from IP address 49.51.12.244 to port 7170

Port Scan: TCP/443

 TCP (SYN) 114.232.142.236:39296 -> port 23, len 40

2020-10-09T14:03:09.622365abusebot-6.cloudsearch.cf sshd[2144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=lmontsouris-655-1-68-235.w80-11.abo.wanadoo.fr  user=root
2020-10-09T14:03:11.275666abusebot-6.cloudsearch.cf sshd[2144]: Failed password for root from 80.11.61.235 port 49466 ssh2
2020-10-09T14:06:54.135703abusebot-6.cloudsearch.cf sshd[2193]: Invalid user ralph from 80.11.61.235 port 55322
2020-10-09T14:06:54.141788abusebot-6.cloudsearch.cf sshd[2193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=lmontsouris-655-1-68-235.w80-11.abo.wanadoo.fr
2020-10-09T14:06:54.135703abusebot-6.cloudsearch.cf sshd[2193]: Invalid user ralph from 80.11.61.235 port 55322
2020-10-09T14:06:56.350563abusebot-6.cloudsearch.cf sshd[2193]: Failed password for invalid user ralph from 80.11.61.235 port 55322 ssh2
2020-10-09T14:10:29.958515abusebot-6.cloudsearch.cf sshd[2261]: Invalid user teste from 80.11.61.235 port 3
...

Oct  9 20:31:21 h2779839 sshd[23028]: Invalid user testing from 202.115.30.5 port 28373
Oct  9 20:31:21 h2779839 sshd[23028]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.115.30.5
Oct  9 20:31:21 h2779839 sshd[23028]: Invalid user testing from 202.115.30.5 port 28373
Oct  9 20:31:24 h2779839 sshd[23028]: Failed password for invalid user testing from 202.115.30.5 port 28373 ssh2
Oct  9 20:36:07 h2779839 sshd[23129]: Invalid user wwwdata from 202.115.30.5 port 47091
Oct  9 20:36:07 h2779839 sshd[23129]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.115.30.5
Oct  9 20:36:07 h2779839 sshd[23129]: Invalid user wwwdata from 202.115.30.5 port 47091
Oct  9 20:36:09 h2779839 sshd[23129]: Failed password for invalid user wwwdata from 202.115.30.5 port 47091 ssh2
Oct  9 20:41:02 h2779839 sshd[23256]: Invalid user tomcat from 202.115.30.5 port 33052
...

ET SCAN NMAP -sS window 1024

Found on   CINS badguys     / proto=6  .  srcport=44773  .  dstport=9633  .     (2745)

2020-10-09T20:55:30.231894hostname sshd[103625]: Failed password for invalid user amavis1 from 119.28.6.128 port 33534 ssh2
...

(sshd) Failed SSH login from 106.12.175.86 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct  9 12:53:28 server2 sshd[4009]: Invalid user library1 from 106.12.175.86
Oct  9 12:53:28 server2 sshd[4009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.86 
Oct  9 12:53:30 server2 sshd[4009]: Failed password for invalid user library1 from 106.12.175.86 port 49934 ssh2
Oct  9 13:00:58 server2 sshd[7956]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.86  user=root
Oct  9 13:01:00 server2 sshd[7956]: Failed password for root from 106.12.175.86 port 55500 ssh2

2020-10-09 22:46:49 auth_plain authenticator failed for (User) [212.70.149.36]: 535 Incorrect authentication data (set_id=mtb@lavrinenko.info)
2020-10-09 22:47:09 auth_plain authenticator failed for (User) [212.70.149.36]: 535 Incorrect authentication data (set_id=aw@lavrinenko.info)
...